Internet-based computer software applications, or “web” applications, are increasingly the target of malicious attacks, as they are typically accessible to anyone with a computer and an Internet connection. In one type of malicious attack known as stored cross-site scripting (stored XSS), an attacker provides a malicious payload as input to a web application which then stores the malicious payload, where a subsequent interaction with the web application results in the malicious payload causing unwanted or unauthorized actions to be performed. For example, a malicious payload may be in the form of JavaScript™ instructions included in a message that the web application stores on a message board. The stored XSS attack succeeds where a client computer subsequently interacts with the web application and receives the stored JavaScript™ instructions from the web application, whereupon the JavaScript™ instructions are executed at the client computer, causing unwanted or unauthorized actions to be performed at or by the client computer.
Web applications are often tested during their development to determine whether they are vulnerable to such malicious attacks or otherwise show signs of security vulnerabilities. One such type of testing known as “black-box” testing involves executing a web application, interacting with the application's interfaces, such as by using known forms of malicious attacks, and then searching for evidence that an interaction exposed a known type of vulnerability. Unfortunately, black-box testing tools have had only limited success determining whether web applications are vulnerable to stored XSS attacks, particularly where stored XSS payloads are not directly observable in a web application response, such as when the payload is incorporated within a JSON/XML response.